[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fM0lyAYSZokDjmADPkdG_fmsZtlRYftTUnKGP71xkN4c":3},{"article":4,"iocs":43,"watch_terms":60,"solutions":61,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"9fe6229c-087f-40c6-ad94-0f8eac806e5f","Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL","three-cvss-10-0-servicenow-flaws-could-let-unauthenticated-attackers-execute-cod-1510fb","ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitable, in certain circumstances, by an unauthenticated attacker. The company said it deployed a security update to hosted instances and provided the update to its partners and self-hosted customers, which leaves organizations that run their","ServiceNow has released patches for four security flaws in its AI Platform, with three vulnerabilities receiving a critical CVSS 10.0 rating. These flaws, including code injection, improper access control, and SQL injection, could allow unauthenticated attackers to execute arbitrary code, modify instance data, and escalate privileges. The company has updated hosted instances and provided patches to partners and self-hosted customers, urging them to apply the fixes.","ServiceNow patches four critical vulnerabilities, three rated CVSS 10.0, allowing unauthenticated code and SQL","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fthree-cvss-100-servicenow-flaws-could.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEitiido-BqtV-H4U0qEAovU_m3NGb3PHF5O3IEh53W_rllGDplhA8aluEKIUULFq3L7iNQue-NLxQDR3wSF7PaaAhGg14rWdqHoB6jBZC1YfslM0wyj5xhESZKTbIxgjO_lnZqVOrKx_E2hK-wXtE85EPJW-pV8D3eMv9CWgMF8eXzsJgq3xevdBY9hCs0\u002Fs1600\u002Fservicenow.jpg","2026-08-28T11:20:32+00:00","2026-08-28T12:00:09.720518+00:00",9,[17,20,22],{"name":18,"type":19},"ServiceNow AI Platform","product",{"name":21,"type":19},"Now Platform",{"name":23,"type":24},"ServiceNow","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,51,54,57],{"type":45,"value":46,"context":47},"cve","CVE-2026-18885","Code injection vulnerability in GraphQL Composite Data API",{"type":45,"value":49,"context":50},"CVE-2026-18886","Improper access control vulnerability in system configuration image upload processor",{"type":45,"value":52,"context":53},"CVE-2026-74820","SQL injection vulnerability in dynamic schema ORDER BY clause",{"type":45,"value":55,"context":56},"CVE-2026-6876","Sandbox escape in the Now Platform",{"type":45,"value":58,"context":59},"CVE-2026-6875","Pre-authentication sandbox escape previously disclosed and observed in the wild",[23,18,21],{"controls":62,"vendors":149},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":42,"name":122,"problem":123,"products":124},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":165},"critical-cvss-100-servicenow-flaws-enable-unauthenticated-code-execution","Critical CVSS 10.0 ServiceNow Flaws Enable Unauthenticated Code Execution","Three critical vulnerabilities in ServiceNow's AI Platform — including code injection, SQL injection, and improper access control — received the maximum CVSS score of 10.0, meaning unauthenticated attackers could fully compromise affected instances without any credentials. The root problem lies in inadequate input validation and missing authentication enforcement on sensitive endpoints, two foundational secure-coding failures. Self-hosted customers face the greatest risk because they must manually apply patches, unlike hosted instances that were updated automatically. This incident underscores how enterprise platforms handling sensitive business data can become single points of catastrophic failure when patch cycles lag behind disclosed vulnerabilities.",[155,156,157,158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-10: Information Input Validation","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","OWASP Top 10: A03 Injection, A01 Broken Access Control","GDPR Article 32: Security of Processing (for EU data held in ServiceNow)","ITIL: Change Management \u002F Emergency Change procedures",{}]